Wednesday, 13 December 2017

Cyberleagle Christmas Quiz

[Updated with answers, 1 January 2018]15 questions to illuminate the festive season. Answers in the New Year. (Remember that this is an English law blog). Tech teasers1. How many data definitions does the Investigatory Powers Act 2016 (IP Act) contain?Twenty-one: Communications data, Relevant communications
data, Entity data, Events data, Internet connection record, Postal data, Private
information, Secondary
data, Systems data, Related systems data, Equipment data, Overseas-related equipment
data, Identifying data, Target data, Authorisation data, Protected data, Personal data, Sensitive personal data, Targeted data, Content, and Data.2. A technical capability notice (TCN) under the IP Act could prevent a message service from providing end to end encryption to its users. True, False or Maybe?Maybe. A TCN could require
the provider to have a capability to remove electronic protection applied by it if,
among other things, that is technically feasible. The most significant question
is whether the message service provider is regarded as itself applying the E2E
encryption. If so, then a TCN could possibly be used to require such a provider
to adopt a different model. If the user is regarded as applying the encryption
then a TCN could not be used.3. Under the IP Act a TCN requiring installation of a permanent equipment interference capability could be served on a telecommunications operator but not a device manufacturer. True, False or Maybe?True. Device
manufacturers are outside the scope of TCNs. If a device manufacturer provides
a telecommunications service (for instance where a phone manufacturer also
provides its own messaging service) then it could be within scope, but only for
its telecommunications service activities.

4. Who made a hash of a hashtag?

In an interview in March 2017 Home Secretary Amber Rudd famously referred to the need for assistance from those
who ‘understand the necessary hashtags’. A week later a Home Office Minister explained
that she had intended to refer to image hashing, not hashtags. So strictly
speaking she made a hashtag of a hash.Brave new world5. Who marked the new era of post-Snowden transparency by holding a private stakeholder-only consultation on a potentially contentious IP Act draft Statutory Instrument?

As required by the IP Act the Home
Secretary consulted various specified stakeholders on draft technical
capability regulations (see 2 and 3 above) prior to laying them before
Parliament for approval. The consultation was conducted privately, excluding the
general public and civil society groups. However the Open Rights Group obtained and published a copy of the draft regulations.6. Who received an early lesson in the independence of the new Investigatory Powers Commissioner?

GCHQ. Its November 2017 approach
to the Investigatory Powers Commissioner to discuss the possibility of a
protocol for reducing evidential issues in Investigatory Powers Tribunal or other
cases was politely but firmly rebuffed.The penumbra of ECJ jurisdiction7. The EU Court of Justice (CJEU) judgment in Watson/Tele2 was issued 22 days after the IP Act received Royal Assent. How long elapsed before the Home Office published proposals to amend the Act to take account of the decision?344 days. The Consultation
was published on 30 November 2017.8. The Investigatory Powers Tribunal has recently made a referral to the CJEU. What is the main question that the CJEU will have to answer about the scope of its Watson decision?Paraphrased, the main question is whether
national security is excluded from the Watson
decision as being outside the scope of EU law.

9. What change was made in the IP Act’s bulk powers, compared with S.8(4) RIPA, that would render the CJEU’s Q.8 answer especially significant?In the IP Act the purposes for which the bulk powers may be exercised
are all framed by reference to national
security. In RIPA (as amended by DRIPA 2014) the serious crime purpose does
not have to be related to national security.10. After Brexit we won't need to worry about CJEU surveillance judgments, even if we exit the EU with no deal. True, False or Maybe?

False, at least if the UK
wishes to have a data protection adequacy determination that would enable EU
countries to transfer personal data to the UK. As the USA discovered in Schrems, a third country’s surveillance regime
can be a significant factor in an adequacy determination.Copyright offline and online11. Tweeting a link to infringing material is itself an infringement of copyright. True, False or Maybe?Maybe, depending on
whether (a) you know that the material is infringing; or (b) you are linking for
financial gain, in which case you would be rebuttably presumed to know. This is
the result of the CJEU’s decision in GS Media.12. Reading an infringing copy of a paper book is not copyright infringement. Viewing an infringing copy online is. True, False or Maybe?

True, at least if what
you do online is sufficiently deliberate and knowing. EU copyright law treats screen and buffer
copies as engaging the reproduction right. The CJEU in Filmspelerheld that the user of a multimedia player add-on
containing links to infringing movies infringed the reproduction right by
viewing an infringing copy accessed via the link. This was because, as a rule, the purchaser of
such a player deliberately and in full knowledge of the circumstances accessed
a free and unauthorised offer of protected works. This took the activity
outside the Copyright Directive’s exception for transient and temporary copies.
The same reasoning can be applied to an online book.

True. Seven years after the Hargreaves Review
identified this as an aspect of copyright that puts the law into confusion and
disrepute, format shifting remains an infringement.

15. Illegal downloading is a crime. True, False or Maybe?False. A user who downloads without the permission of the copyright owner commits a civil infringement of copyright, but
without more that is not a crime. In 2014
PIPCU (the Police Intellectual Property Crime Unit) deployed replacement
website ads proclaiming that ‘Illegal downloading is a crime’. PIPCU later explained this on the basis that “Downloading falls within s.45 of the Serious
Crime Act 2007 if it encourages s.107 CDPA 1988 offences”.

Please Note

The views expressed in this blog are the personal views of Graham Smith alone and are not attributable to the law firm for which he works or to any of its clients. Nothing in this blog constitutes legal advice. Always take advice from a suitably qualified legal practitioner in relation to a specific matter.